140 lines
5.1 KiB
Python
140 lines
5.1 KiB
Python
import logging
|
|
|
|
from sqlalchemy import text
|
|
|
|
from app.db.models import Activity, ActivityStatus
|
|
|
|
|
|
def test_mfa_code_is_used_once_and_not_persisted(authenticated_client, fake_sync_manager, app, caplog) -> None:
|
|
with caplog.at_level(logging.DEBUG):
|
|
response = authenticated_client.post(
|
|
"/users/1/garmin-mfa",
|
|
data={"csrf_token": authenticated_client.csrf_token, "code": "123456"},
|
|
)
|
|
assert response.status_code == 200
|
|
assert fake_sync_manager.mfa_calls == [(1, "123456")]
|
|
|
|
# Defense-in-depth: the MFA code must never end up written to the real
|
|
# app database (the one authenticated_client's requests actually hit),
|
|
# not some unrelated in-memory db.
|
|
with app.state.session_factory() as session:
|
|
persisted_text = " ".join(str(row) for row in session.execute(text("select * from sync_runs")).all())
|
|
assert "123456" not in persisted_text
|
|
|
|
# The check that actually matters: the code must never be logged,
|
|
# regardless of which SyncManager implementation is in play.
|
|
assert "123456" not in caplog.text
|
|
|
|
|
|
def test_mfa_code_rejects_empty_code(authenticated_client, fake_sync_manager) -> None:
|
|
response = authenticated_client.post(
|
|
"/users/1/garmin-mfa",
|
|
data={"csrf_token": authenticated_client.csrf_token, "code": " "},
|
|
)
|
|
assert response.status_code == 400
|
|
assert fake_sync_manager.mfa_calls == []
|
|
|
|
|
|
def test_mfa_code_rejects_overlong_code(authenticated_client, fake_sync_manager) -> None:
|
|
response = authenticated_client.post(
|
|
"/users/1/garmin-mfa",
|
|
data={"csrf_token": authenticated_client.csrf_token, "code": "1" * 21},
|
|
)
|
|
assert response.status_code == 400
|
|
assert fake_sync_manager.mfa_calls == []
|
|
|
|
|
|
def _seed_activity(app, *, status: ActivityStatus, last_completed_stage: ActivityStatus, retryable: bool, last_error: str | None = None) -> tuple[int, int]:
|
|
"""Seed a real Activity (and its owning user) in the app fixture's actual
|
|
database -- the same database authenticated_client's HTTP requests hit --
|
|
and return (user_id, activity_id)."""
|
|
from app.db.repositories import ActivityRepository, UserRepository
|
|
|
|
with app.state.session_factory() as session:
|
|
user = UserRepository(session).create(
|
|
name="MFA Test User",
|
|
enabled=True,
|
|
mywhoosh_email_enc="mw@example.com",
|
|
mywhoosh_password_enc="mw-pass",
|
|
garmin_email_enc="garmin@example.com",
|
|
garmin_password_enc="garmin-pass",
|
|
)
|
|
activity_repo = ActivityRepository(session)
|
|
activity, _ = activity_repo.get_or_create_discovered(
|
|
user_id=user.id,
|
|
mywhoosh_activity_id="mw-activity-1",
|
|
activity_name="Test Activity",
|
|
activity_timestamp=None,
|
|
)
|
|
activity.status = status
|
|
activity.last_completed_stage = last_completed_stage
|
|
activity.retryable = retryable
|
|
if last_error is not None:
|
|
activity.last_error = last_error
|
|
session.commit()
|
|
return user.id, activity.id
|
|
|
|
|
|
def test_retry_resets_and_calls_sync_for_retryable_failed_activity(authenticated_client, fake_sync_manager, app) -> None:
|
|
user_id, activity_id = _seed_activity(
|
|
app,
|
|
status=ActivityStatus.FAILED,
|
|
last_completed_stage=ActivityStatus.CONVERTED,
|
|
retryable=True,
|
|
last_error="some transient error",
|
|
)
|
|
|
|
response = authenticated_client.post(
|
|
f"/activities/{activity_id}/retry",
|
|
data={"csrf_token": authenticated_client.csrf_token},
|
|
)
|
|
|
|
assert response.status_code == 200
|
|
assert fake_sync_manager.user_calls == [user_id]
|
|
|
|
with app.state.session_factory() as session:
|
|
reloaded = session.get(Activity, activity_id)
|
|
assert reloaded.status == ActivityStatus.CONVERTED
|
|
assert reloaded.last_error is None
|
|
|
|
|
|
def test_retry_rejects_non_retryable_activity(authenticated_client, fake_sync_manager, app) -> None:
|
|
user_id, activity_id = _seed_activity(
|
|
app,
|
|
status=ActivityStatus.FAILED,
|
|
last_completed_stage=ActivityStatus.CONVERTED,
|
|
retryable=False,
|
|
last_error="permanent failure",
|
|
)
|
|
|
|
response = authenticated_client.post(
|
|
f"/activities/{activity_id}/retry",
|
|
data={"csrf_token": authenticated_client.csrf_token},
|
|
)
|
|
|
|
assert response.status_code == 409
|
|
assert fake_sync_manager.user_calls == []
|
|
|
|
with app.state.session_factory() as session:
|
|
reloaded = session.get(Activity, activity_id)
|
|
assert reloaded.status == ActivityStatus.FAILED
|
|
assert reloaded.retryable is False
|
|
assert reloaded.last_error == "permanent failure"
|
|
|
|
|
|
def test_retry_rejects_non_failed_activity(authenticated_client, fake_sync_manager, app) -> None:
|
|
user_id, activity_id = _seed_activity(
|
|
app,
|
|
status=ActivityStatus.DISCOVERED,
|
|
last_completed_stage=ActivityStatus.DISCOVERED,
|
|
retryable=True,
|
|
)
|
|
|
|
response = authenticated_client.post(
|
|
f"/activities/{activity_id}/retry",
|
|
data={"csrf_token": authenticated_client.csrf_token},
|
|
)
|
|
|
|
assert response.status_code == 409
|
|
assert fake_sync_manager.user_calls == []
|